How aquasecurity/linux-bench works
linux-bench is a command-line CIS Linux security benchmark runner. An operator invokes it with options to select a benchmark version or checks; it detects host characteristics, chooses and loads matching YAML definitions, runs checks through the external bench-common engine, and formats the results. The README also describes platform, boot-loader, logging, and LSM-based test selection. Source excerpts show the runner and detection logic; the definitions are present in the tree, but their contents and individual check behavior were not sampled.
Main entry points: app.go Benchmark runner · main.go Program entry · root.go CLI options · utils.go Host detection
Components 10
CLI interface
- Program entry
main.go - CLI options
root.go
Host and benchmark selection
- Host detection
utils.go - Benchmark runner
app.go - Benchmark definitions
cfg
Check execution
- Check engine
Results
- Result formatting
app.go
Other components
- Operator
- Linux host
- Terminal or file
Connections 9
- Operator → Program entry: invokes
README.md - Program entry → CLI options: starts command
main.go - CLI options → Benchmark runner: runs
root.go - Benchmark runner → Host detection: detects host
app.go - Host detection → Linux host: queries
utils.go - Benchmark runner → Benchmark definitions: selects and reads
app.go - Benchmark runner → Check engine: loads and runs checks
app.go - Benchmark runner → Result formatting: formats results
app.go - Result formatting → Terminal or file: prints or writes
app.go